{"id":"CVE-2026-17294","published":"2026-11-07T05:18:36.743","lastModified":"2026-11-10T16:24:11.050","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated remote attacker to force the application to make unintended requests to internal or external systems, potentially exposing sensitive internal data or services.","exploitability":"Exploitation requires valid authentication credentials and the ability to submit crafted requests to vulnerable endpoints; no public exploit code is available, but the low attack complexity makes it feasible for skilled attackers.","blast_radius":"Successful exploitation could lead to unauthorized access to internal network resources, cloud metadata services, or sensitive backend APIs, with high confidentiality impact and some integrity risk due to potential manipulation of SSRF-targeted systems.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.","detection":"Defenders should monitor for anomalous outbound HTTP/HTTPS requests from API Connect management or gateway nodes to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16–31.x.x), localhost addresses, or cloud metadata endpoints (e.g., 169.254.169.254) in gateway or management plane logs; unusual request patterns to externally resolvable domains not in approved allowlists may also indicate SSRF attempts.","tags":["ssrf","cwe-918","authenticated","ibm","api-connect","info-disclosure"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:50:03.301Z"}}